From: syzbot <syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: balbi@kernel.org, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com
Subject: Re: Re: memory leak in hub_event
Date: Fri, 20 Nov 2020 08:56:11 -0800 [thread overview]
Message-ID: <000000000000c49c8b05b48cb833@google.com> (raw)
In-Reply-To: <20201120165609.GE619708@rowland.harvard.edu>
> On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
>> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
>> compiler: gcc (GCC) 10.1.0-syz 20200507
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
>>
>> BUG: memory leak
>> unreferenced object 0xffff88810d5ff800 (size 2048):
>> comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
>> hex dump (first 32 bytes):
>> ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
>> 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
>> backtrace:
>> [<00000000f0428224>] kmalloc include/linux/slab.h:552 [inline]
>> [<00000000f0428224>] kzalloc include/linux/slab.h:664 [inline]
>> [<00000000f0428224>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
>> [<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
>> [<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
>> [<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
>> [<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
>> [<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
>> [<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
>> [<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
>> [<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
>
> This looks like a reference is being taken but not released. Hard to
> tell where it's happening, though. Let's try to narrow it down.
>
> Alan Stern
>
> #syz test: upstream 4d02da97
"upstream" does not look like a valid git repo address.
>
> Index: usb-devel/drivers/media/usb/gspca/gspca.c
> ===================================================================
> --- usb-devel.orig/drivers/media/usb/gspca/gspca.c
> +++ usb-devel/drivers/media/usb/gspca/gspca.c
> @@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
> }
>
> gspca_dev->v4l2_dev.release = gspca_release;
> + ret = -EIO;
> + goto out;
> ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
> if (ret)
> goto out;
next prev parent reply other threads:[~2020-11-20 16:57 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-20 15:15 memory leak in hub_event syzbot
2020-11-20 16:56 ` Alan Stern
2020-11-20 16:56 ` syzbot [this message]
2020-11-20 17:00 ` Alan Stern
2020-11-23 18:29 ` Andrey Konovalov
2020-11-23 18:44 ` syzbot
2020-11-23 19:32 ` Alan Stern
2020-11-23 19:42 ` syzbot
2020-11-23 19:53 ` Alan Stern
2020-11-23 20:01 ` syzbot
2020-11-23 20:38 ` Alan Stern
2020-11-23 20:48 ` syzbot
2020-11-23 21:53 ` Alan Stern
2020-11-23 22:09 ` syzbot
2020-11-23 22:24 ` Alan Stern
2020-11-24 11:38 ` Hans Verkuil
2020-11-24 16:00 ` [PATCH] media: gspca: Fix memory leak in probe Alan Stern
2020-12-02 8:58 ` Hans Verkuil
2020-12-02 17:20 ` [PATCH v2] " Alan Stern
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
2020-12-02 16:37 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c49c8b05b48cb833@google.com \
--to=syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com \
--cc=balbi@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.